Google Chrome blocks the download claiming it contains Win32/Malgent!MTB malware

[vacari]

Describe the bug
Google Chrome blocks the download claiming it contains Win32/Malgent!MTB malware

To reproduce
Steps to reproduce the behavior:
On the page https://github.com/win32ss/supermium/releases/tag/v124 go to the "Assets" section and click on the link "supermium_124_32_setup.exe" (https://github.com/win32ss/supermium/releases/tag/v124#:~:text=supermium_124_32_setup.exe)

Desktop

• OS: Windows 11 Pro 64
• Chrome 127.0.6533.89 (Versão oficial) 64 bits

Screenshots

[thinkpad4]

@vacari It's been reported before, it's a false flag #765 and #315 #748

[vacari]

@vacariJá foi relatado antes, é uma bandeira falsa #765 e #315 #748

Ok Thank you!

[vacari]

I reopened just to report that after disabling Chrome Security then Windows Security also reports Virus and remove file, as below:
Detected:Trojan:Win32/Malgent!MTB
Status:Removed

webfile: G:\supermium_124_32_setup.exe|https://objects.githubusercontent.com/github-production-release-asset-2e65be/638089306/7edd9b3e-c204-4f7a-9a5a-302f3b09b9e6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240806%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240806T023231Z&X-Amz-Expires=300&X-Amz-Signature=0292369e0a7eab385050f064285c71ab550480ffb7f40f5e74668bf88ee77db5&X-Amz-SignedHeaders=host&actor_id=6704887&key_id=0&repo_id=638089306&response-content-disposition=attachment%3B%20filename%3Dsupermium_124_32_setup.exe&response-content-type=application%2Foctet-stream|pid:18708,ProcessStart:133673851561375293

[thinkpad4]

You might have to disable Windows Security to get it installed then delete the setup file and reenable security. The actual browser doesn't trigger security it's something about how the 32bit setup installer is made that causes a false flag. It REALLY is 100% safe.

[itrack]

I installed on Windows XP with a Kaspersky antivirus, reported progwrp.dll as malware.

[jonm58]

I installed on Windows XP with a Kaspersky antivirus, reported progwrp.dll as malware.

just false flag

[random-pixels]

Just encountered this when trying to resurrect an ancient Windows Vista computer (over the phone! lol) that had Chrome version like 40-something (or whatever the latest version on Vista was). Unable to download anything from GitHub due to GitHub not supporting browsers that old. Found the download (win32) on another site that worked, and got this error. Google results on how to get around it were next to useless since all the instructions were for later versions of Chrome. Finally found this, showing the old Chrome settings you need to disable, and thought I'd add it here in case it helps anyone: https://www.youtube.com/watch?v=ROqKE5h6Tk4

[Vangelis66]

@random-pixels :

Supermium's dedicated official homepage comes in two flavours:

https://www.win32subsystem.live/supermium/

https://www.win32subsystem.live/supermium/legacy/

which should be compatible (especially the "legacy" one) with down to Internet Explorer 6 (default browser on a fresh installation of WinXP); both flavours contain links to the latest Supermium installers 😉 ...

As for Vista SP2, IE9 has no issues there:

IE isn't a Google product, so "they" can't interfere with the download via their "Safe Browsing" 😠 ...

TL;DR: One shouldn't need/rely on Google Chrome 49 👎 under Vista to fetch and install latest Supermium there 😜 ...

[win32ss]

The 32 bit Supermium installer is a major issue for many AVs. Most of the detections disappear if I remove the registry modification part of the installer, which isn't a valid solution. But I will be modifying this section to add an option to write to HKCU instead of HKLM, which should impact the heuristic view of the installer.

[random-pixels]

@random-pixels :

Supermium's dedicated homepage comes into two flavours:

https://www.win32subsystem.live/supermium/

https://www.win32subsystem.live/supermium/legacy/

Thank you so much for this! Unfortunately, this site did not show up in Google's search results, nor was it mentioned on the GitHub page's Readme, so I didn't know it existed. I would much rather have gotten the file from an authorized source than a third-party downloader, but there you have it. Luckily we got it up and running and it works great (just slowly, which is understandable for a modern browser on such an old machine). Hopefully it helps someone else though!

[Vangelis66]

Thank you so much for this!

You're most welcome! 😄 ...

this site did not show up in Google's search results

... key word there being "Google" 😡 ; don't you see the pattern? "They" are the arch-enemies of everything "legacy"...

nor was it mentioned on the GitHub page's Readme, so I didn't know it existed.

FWIW, there's a very prominent link to the official site once one arrives to the main Supermium GitHub repo page 😉 :

... but, of course, you need a fairly recent browser to properly render that page...

Best regards 😄 !

[win32ss]

Recently, a modification was made to the Supermium installer to incorporate the option to install Supermium for the whole system (writing to HKLM and placing shortcuts in All Users desktop) or for an individual user (writing to HKCU and placing shortcuts in the user's desktop folder). These changes reduced the number of VirusTotal detections on the 32 bit Supermium installer from 17/75 to 8/75.

Actually, there is one change I have to make; all registration keys must go into HKLM even on a per-user install if it's on something older than Windows 8 (this isn't documented officially by MS, only deep in the Chromium source code, and I was wondering why there was no Supermium registration in the default programs list on XP or 7 with a per-user install). This would have another impact on the AV results.